CMMC compliance services
CMMC compliance services for defense contractors
We help defense contractors and DIB suppliers prepare for CMMC Levels 1, 2 and 3: gap assessments, NIST SP 800-171 implementation and C3PAO readiness, delivered fixed-price with no surprises.
What is CMMC and why does it matter?
The Cybersecurity Maturity Model Certification (CMMC) is the DoD's cybersecurity framework for the Defense Industrial Base. Under DFARS 252.204-7021, a contractor that handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) must meet the CMMC level its contract requires before it can win or keep that work.
CMMC 2.0 is a three-level framework built on NIST SP 800-171. It builds directly on DFARS 252.204-7012, the clause that has required DoD contractors to implement NIST SP 800-171 since 2017. The difference is verification: CMMC adds affirmed assessments by the contractor itself, independent assessments by accredited C3PAOs and government-led assessments, depending on the sensitivity of the information you handle.
Most defense contractors underestimate how much CUI they actually handle. Once CUI enters your environment, all 110 NIST SP 800-171 controls are in scope, which is why scoping your CUI enclave correctly is the single most impactful step you can take before starting remediation.
Who needs CMMC compliance?
Prime contractors and subcontractors alike: requirements flow down from primes to every tier that receives FCI or CUI.
Prime contractors
- Must flow CMMC requirements down to every subcontractor that receives FCI or CUI
- SPRS score must reflect the actual System Security Plan
- Annual affirmation by a senior official
Subcontractors and DIB suppliers
- Flow-down clauses in subcontracts require CMMC compliance
- Primes are refusing awards to suppliers without a compliant posture
- The same assessment standards apply regardless of company size
IT and managed service providers
- Providers with access to systems that process CUI can be part of the contractor's assessment boundary
- Cloud services that hold CUI must meet FedRAMP Moderate or equivalent
- Flow-down to IT providers is a common oversight
Which CMMC level do you need?
The level is driven by the type of information you handle under your DoD contracts. Here is how CMMC 2.0 breaks down.
LEVEL 1
Foundational
- 15 basic safeguarding requirements from FAR 52.204-21
- For contractors that handle Federal Contract Information (FCI) only, no CUI
- An annual Level 1 (Self) assessment with a senior official's affirmation in SPRS
- No third-party assessment
LEVEL 2
Advanced
- All 110 security requirements of NIST SP 800-171 Rev 2
- For contractors that store, process or transmit CUI
- Under the final rule, a C3PAO assessment every three years for most contracts, with Level 2 (Self) assessments on a subset
- The level the vast majority of defense contractors will need
LEVEL 3
Expert
- All Level 2 requirements plus selected NIST SP 800-172 enhanced requirements
- For contractors supporting the DoD's highest-priority programs
- Government-led assessment by DIBCAC every three years
- Applies to a small number of contractors
Most DoD contractors handling CUI will need Level 2. If you are unsure, we will review your contracts and DFARS clauses with you at no cost. See also CMMC Level 1 vs Level 2.
What do our CMMC compliance services include?
End-to-end CMMC consulting at every stage, from initial gap assessment through assessment and ongoing managed compliance.
Gap assessment
A full review of your environment against all 110 NIST SP 800-171 controls, with a documented SPRS score, a CUI inventory and a prioritized remediation roadmap. Your gap assessment is the foundation everything else builds on.
Readiness assessment
A mock assessment that mirrors the official CMMC assessment methodology. We collect objective evidence, run through interview questions and identify every gap before your actual assessment, so nothing surprises you on the day.
Policy and documentation
Your System Security Plan (SSP), Plan of Action and Milestones (POA&M), incident response plan and the full supporting policy library, written in plain English and tailored to how your business actually operates, not a generic template.
Technical controls implementation
Network segmentation, FIPS-validated encryption, multi-factor authentication, audit logging, vulnerability management and endpoint hardening across your in-scope environment. We implement, not just advise.
Managed compliance
Ongoing log review, vulnerability scanning, quarterly evidence refresh and annual SSP updates so your CMMC posture holds between assessments. Our 24/7 managed SOC keeps your environment monitored and documented.
C3PAO assessment support
Scoping, scheduling, evidence packaging, interview coaching and on-site support during your formal assessment.
How do we get you to CMMC compliance?
A fixed-scope engagement model built around how defense contractors actually operate.
Fixed-price engagements. Scoped, capped engagements with clear deliverables: no open-ended hourly billing and no surprise change orders.
STEP 1
Initial consultation
We review your DoD contracts, DFARS clauses and the types of FCI and CUI you handle to confirm the CMMC level you need and define the boundary of your assessment scope.
STEP 2
Scope and gap assessment
We identify every system, user and data flow that touches CUI, define the boundary of your CMMC environment and assess your posture against all 110 controls. You receive a scored gap report and an SPRS score you can stand behind.
STEP 3
Remediation roadmap
We prioritize gaps by risk and complexity, build a realistic timeline that fits your contract obligations and assign clear ownership for every remediation action. Not a 200-item checklist with no order: a sequenced plan your team can execute.
STEP 4
Policy and technical remediation
We write your SSP, POA&M and supporting policies, then implement the technical controls (MFA, network segmentation, FIPS encryption, audit logging, endpoint hardening) across your in-scope environment.
STEP 5
Assessment support and managed compliance
We run a full mock assessment, close remaining gaps, package your evidence and coach your team, then keep documentation current and controls operating between assessments.
CMMC services for every defense industry
We specialize in defense supply chain cybersecurity across every tier and vertical.
- Manufacturing
- Aerospace
- Defense Contractors
- Construction (Federal / DoD)
- Engineering & Architecture
- Electronics & Circuit Board Manufacturing
- Metal Fabrication & Welding
- Chemical Manufacturing (DoD Supply Chain)
- Logistics & Supply Chain
- Research & Development
- Professional Services (Defense Support)
- Maritime / Shipbuilding
- Environmental & Hazmat Services
- Printing & Secure Documentation
Cyber Grants Alliance
Small defense contractor? Apply for an in-kind CMMC grant
Telco United supports the Cyber Grants Alliance. Its CMMC Level 1 and Level 2 gap assessment grants are in-kind, at no cost to you for qualifying small and medium-sized businesses: an independent certified assessor evaluates your controls and you get prioritized findings, so you know where you stand.
CMMC compliance questions
What is CMMC?
The Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense program that verifies contractors in the defense industrial base implement the cybersecurity practices required to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). It is codified in 32 CFR Part 170 and applied to contracts through DFARS 252.204-7021.
Who needs CMMC compliance?
Any company in the Defense Industrial Base that processes, stores or transmits FCI or CUI in performance of a DoD contract, prime contractors and subcontractors alike. Managed service providers and IT vendors with access to systems that process CUI on a contractor's behalf can also fall within the assessment boundary.
Which CMMC level do I need?
It depends on the information you handle under your DoD contracts. Level 1 covers contractors that handle only FCI. Level 2 covers contractors that handle CUI, which is most defense contractors. Level 3 is reserved for contractors on the DoD's highest-priority programs. If you are unsure, we will review your contracts and DFARS clauses with you at no cost.
What is the status of CMMC Phase 2?
On July 13, 2026 the Department of War paused the CMMC rollout and suspended the Phase 2 transition that was scheduled for November 2026, pending a 60 day review. During the pause, solicitations may require CMMC Level 1 (Self) or Level 2 (Self) assessments, and DFARS 252.204-7012, NIST SP 800-171 Rev 2, SPRS scores and the annual affirmation remain in effect.
Is CUI more than classified-looking documents?
Yes. Most defense contractors underestimate how much CUI they handle. Contract drawings, program schedules, technical data packages and even routine email threads referencing part numbers can all qualify as CUI under the National Archives CUI registry. Once CUI enters your environment, all 110 NIST SP 800-171 controls are in scope, so scoping your CUI enclave correctly is the most impactful step before remediation.
Do I have to put every workstation and user on MFA?
NIST 800-171 is risk-based. We identify which systems actually handle CUI, scope them into a defined enclave, and apply the strictest controls (MFA, FIPS encryption, audit logging) at that boundary rather than across the entire business.
Schedule a free CMMC consultation
Tell us about your contracts and environment. We will confirm the level you need and what it takes to get there.
When was the last time you ran a cyber risk assessment?
Tell us about your environment and your contracts. We will tell you where you stand and what to fix first.